feat(dex2oat): inject dex2oat instead of mount for anti-detection

daemon/src/main/kotlin/org/matrix/vector/daemon/VectorDaemon.kt

@@ -299,6 +299,7 @@ object VectorDaemon {
    */
   fun softReboot() {
     Log.w(TAG, "Soft reboot: restarting the primary zygote")
+    Dex2OatServer.onSoftReboot()
     forgetDeliberateBoot()
     SystemProperties.set("ctl.restart", "zygote")
   }

daemon/src/main/kotlin/org/matrix/vector/daemon/env/Dex2OatServer.kt

@@ -1,9 +1,13 @@
 package org.matrix.vector.daemon.env
 
 import android.net.LocalServerSocket
+import android.net.LocalSocket
+import android.net.LocalSocketAddress
 import android.os.Build
 import android.os.FileObserver
 import android.os.SELinux
+import android.os.SystemClock
+import android.os.SystemProperties
 import android.system.ErrnoException
 import android.system.Os
 import android.system.OsConstants
@@ -25,6 +29,7 @@ val DEX2OAT_MOUNT_FAILED = IManagerService.DEX2OAT_MOUNT_FAILED
 val DEX2OAT_SEPOLICY_INCORRECT = IManagerService.DEX2OAT_SEPOLICY_INCORRECT
 val DEX2OAT_SELINUX_PERMISSIVE = IManagerService.DEX2OAT_SELINUX_PERMISSIVE
 val DEX2OAT_CRASHED = IManagerService.DEX2OAT_CRASHED
+val DEX2OAT_INJECTED = IManagerService.DEX2OAT_INJECTED
 
 object Dex2OatServer {
   private const val WRAPPER32 = "bin/dex2oat32"
@@ -85,6 +90,7 @@ object Dex2OatServer {
 
   private fun onSelinuxEvent() {
     synchronized(this) {
+      if (compatibility == DEX2OAT_INJECTED) return
       if (compatibility == DEX2OAT_CRASHED) {
         SelinuxObserver.stopWatching()
         return
@@ -209,7 +215,87 @@ object Dex2OatServer {
     doMountNative(enabled, dex2oatArray[0], dex2oatArray[1], dex2oatArray[2], dex2oatArray[3])
   }
 
+  private fun injectionTargetName(): String {
+    val useArtService = SystemProperties.get("dalvik.vm.useartservice")
+    return if (Build.VERSION.SDK_INT >= 35 ||
+        (Build.VERSION.SDK_INT == 34 && (useArtService == "true" || useArtService == "1")))
+        "artd"
+    else "installd"
+  }
+
+  private fun processExists(name: String): Boolean {
+    val entries = File("/proc").list() ?: return false
+    for (entry in entries) {
+      if (entry.isEmpty() || !entry[0].isDigit()) continue
+      val command =
+          runCatching {
+                File("/proc/$entry/cmdline").readBytes().toString(Charsets.UTF_8)
+              }
+              .getOrNull() ?: continue
+      val executable = command.substringBefore('\u0000')
+      if (executable.isNotEmpty() && File(executable).name == name) return true
+    }
+    return false
+  }
+
+  private fun probeMonitor(name: String): Boolean {
+    val path = "/data/adb/lspd/dex2oat_monitor_$name"
+    val deadline = SystemClock.uptimeMillis() + 1000L
+    do {
+      var socket: LocalSocket? = null
+      try {
+        socket = LocalSocket()
+        socket.connect(LocalSocketAddress(path, LocalSocketAddress.Namespace.FILESYSTEM))
+        runCatching { socket.setSoTimeout(250) }
+        val status = socket.inputStream.read()
+        if (status == 1) return true
+        if (status >= 0) return false
+      } catch (_: Throwable) {
+      } finally {
+        runCatching { socket?.close() }
+      }
+      try {
+        Thread.sleep(25L)
+      } catch (_: InterruptedException) {
+        return false
+      }
+    } while (SystemClock.uptimeMillis() < deadline)
+    return false
+  }
+
+  private fun probeInjection(): Boolean {
+    val preferred = injectionTargetName()
+    if (processExists(preferred)) return probeMonitor(preferred)
+    val fallback = if (preferred == "artd") "installd" else "artd"
+    if (processExists(fallback)) return probeMonitor(fallback)
+    return probeMonitor(preferred) || probeMonitor(fallback)
+  }
+
+  fun onSoftReboot() {
+    if (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q) return
+    if (probeInjection()) {
+      if (!notMounted()) doMount(false)
+      if (notMounted()) {
+        compatibility = DEX2OAT_INJECTED
+        return
+      }
+    }
+    if (compatibility == DEX2OAT_INJECTED) return
+    doMount(false)
+    doMount(true)
+    compatibility = if (notMounted()) DEX2OAT_MOUNT_FAILED else DEX2OAT_OK
+  }
+
   fun start() {
+    if (probeInjection()) {
+      if (!notMounted()) doMount(false)
+      if (notMounted()) {
+        compatibility = DEX2OAT_INJECTED
+        Log.i(TAG, "dex2oat injection is active; wrapper stays off")
+        return
+      }
+    }
+
     if (notMounted()) {
       doMount(true)
       if (notMounted()) {

dex2oat/src/main/cpp/CMakeLists.txt

@@ -2,7 +2,7 @@ cmake_minimum_required(VERSION 3.10)
 project(dex2oat)
 
 add_executable(dex2oat dex2oat.cpp)
-add_library(oat_hook SHARED oat_hook.cpp)
+add_library(oat_hook SHARED oat_hook.cpp compiler_options.cpp)
 
 OPTION(LSPLT_BUILD_SHARED OFF)
 add_subdirectory(${VECTOR_ROOT}/external/lsplt/lsplt/src/main/jni external)

dex2oat/src/main/cpp/compiler_options.cpp

@@ -0,0 +1,17 @@
+#include <android/log.h>
+#include <dlfcn.h>
+
+#include <cstddef>
+
+extern "C" __attribute__((visibility("default"))) void _ZN3art15CompilerOptionsC1Ev(void *self) {
+    using Constructor = void (*)(void *);
+    static Constructor original =
+        reinterpret_cast<Constructor>(dlsym(RTLD_NEXT, "_ZN3art15CompilerOptionsC1Ev"));
+    if (original == nullptr) return;
+
+    original(self);
+
+    constexpr size_t kInlineMaxCodeUnitsOffset = sizeof(void *) == 8 ? 16 : 8;
+    auto *units = reinterpret_cast<size_t *>(static_cast<char *>(self) + kInlineMaxCodeUnitsOffset);
+    *units = 0;
+}

dex2oat/src/main/cpp/oat_hook.cpp

@@ -211,6 +211,8 @@ void register_hook(dev_t dev, ino_t inode, const char* symbol, void* new_func, v
 #define PLT_HOOK_REGISTER(DEV, INODE, NAME) PLT_HOOK_REGISTER_SYM(DEV, INODE, #NAME, NAME)
 
 __attribute__((constructor)) static void initialize() {
+    if (getenv("VECTOR_INJECTED") != nullptr) return;
+
     dev_t dev = 0;
     ino_t inode = 0;
 
@@ -227,7 +229,7 @@ __attribute__((constructor)) static void initialize() {
     }
 
     if (dev == 0) {
-        LOGE("Could not locate dex2oat memory map");
+        LOGD("Could not locate dex2oat memory map");
         return;
     }
 

manager/src/main/kotlin/org/matrix/vector/manager/ui/screens/home/HomeViewModel.kt

@@ -427,7 +427,9 @@ class HomeViewModel(
             // deletes `dalvik.vm.dex2oat-flags` when it mounts the wrapper over dex2oat and sets
             // it when it unmounts, so either route suppresses the inlining. A wrapper that is not
             // OK therefore only costs anything when the property is not carrying the flag either.
-            if (dex2oat != IManagerService.DEX2OAT_OK && !inliningDisabled) {
+            if (dex2oat != IManagerService.DEX2OAT_OK &&
+                dex2oat != IManagerService.DEX2OAT_INJECTED &&
+                !inliningDisabled) {
                 add(HealthIssue.Dex2oatWrapperBroken)
             }
         }

manager/src/main/kotlin/org/matrix/vector/manager/ui/screens/home/SystemStatusScreen.kt

@@ -814,7 +814,8 @@ private fun buildSections(
                         str(R.string.info_dex2oat),
                         dex2oatLabel(context, status.dex2oatWrapperState),
                         health =
-                            if (status.dex2oatWrapperState == IManagerService.DEX2OAT_OK)
+                            if (status.dex2oatWrapperState == IManagerService.DEX2OAT_OK ||
+                                status.dex2oatWrapperState == IManagerService.DEX2OAT_INJECTED)
                                 Health.Good
                             else Health.Bad,
                         monospace = false,
@@ -832,17 +833,29 @@ private fun buildSections(
     )
 }
 
-private fun dex2oatLabel(context: Context, state: Int): String =
-    context.getString(
-        when (state) {
-            IManagerService.DEX2OAT_OK -> R.string.info_supported
-            IManagerService.DEX2OAT_CRASHED -> R.string.info_dex2oat_crashed
-            IManagerService.DEX2OAT_MOUNT_FAILED -> R.string.info_dex2oat_mount_failed
-            IManagerService.DEX2OAT_SELINUX_PERMISSIVE -> R.string.info_dex2oat_selinux_permissive
-            IManagerService.DEX2OAT_SEPOLICY_INCORRECT -> R.string.info_dex2oat_sepolicy_incorrect
-            else -> R.string.info_unsupported
-        }
-    )
+private fun dex2oatLabel(context: Context, state: Int): String {
+    val label =
+        context.getString(
+            when (state) {
+                IManagerService.DEX2OAT_OK -> R.string.info_supported
+                IManagerService.DEX2OAT_INJECTED -> R.string.info_supported
+                IManagerService.DEX2OAT_CRASHED -> R.string.info_dex2oat_crashed
+                IManagerService.DEX2OAT_MOUNT_FAILED -> R.string.info_dex2oat_mount_failed
+                IManagerService.DEX2OAT_SELINUX_PERMISSIVE ->
+                    R.string.info_dex2oat_selinux_permissive
+                IManagerService.DEX2OAT_SEPOLICY_INCORRECT ->
+                    R.string.info_dex2oat_sepolicy_incorrect
+                else -> R.string.info_unsupported
+            }
+        )
+    return when (state) {
+        IManagerService.DEX2OAT_OK ->
+            "$label (${context.getString(R.string.info_mounted)})"
+        IManagerService.DEX2OAT_INJECTED ->
+            "$label (${context.getString(R.string.info_injected)})"
+        else -> label
+    }
+}
 
 @Composable
 private fun FrameworkToggle(

manager/src/main/res/values-ar/strings.xml

@@ -42,6 +42,7 @@
     <string name="info_loaded">محمَّلة</string>
     <string name="info_not_loaded">غير محمَّلة</string>
     <string name="info_injected">محقون</string>
+    <string name="info_mounted">مُركّب</string>
     <string name="info_not_injected">غير محقون</string>
     <string name="status_notification">إشعار الحالة</string>
     <string name="status_notification_summary">إشعار دائم يبيّن أن Vector يعمل.</string>

manager/src/main/res/values-de/strings.xml

@@ -42,6 +42,7 @@
     <string name="info_loaded">Geladen</string>
     <string name="info_not_loaded">Nicht geladen</string>
     <string name="info_injected">Injiziert</string>
+    <string name="info_mounted">Eingehängt</string>
     <string name="info_not_injected">Nicht injiziert</string>
     <string name="status_notification">Statusbenachrichtigung</string>
     <string name="status_notification_summary">Eine dauerhafte Benachrichtigung, die anzeigt, dass Vector läuft.</string>

manager/src/main/res/values-es/strings.xml

@@ -42,6 +42,7 @@
     <string name="info_loaded">Cargada</string>
     <string name="info_not_loaded">No cargada</string>
     <string name="info_injected">Inyectado</string>
+    <string name="info_mounted">Montado</string>
     <string name="info_not_injected">No inyectado</string>
     <string name="status_notification">Notificación de estado</string>
     <string name="status_notification_summary">Una notificación permanente que indica que Vector está en marcha.</string>

manager/src/main/res/values-fa/strings.xml

@@ -42,6 +42,7 @@
     <string name="info_loaded">بارگذاری‌شده</string>
     <string name="info_not_loaded">بارگذاری‌نشده</string>
     <string name="info_injected">تزریق‌شده</string>
+    <string name="info_mounted">متصل‌شده</string>
     <string name="info_not_injected">تزریق‌نشده</string>
     <string name="status_notification">اعلان وضعیت</string>
     <string name="status_notification_summary">اعلانی ماندگار که نشان می‌دهد Vector در حال اجراست.</string>

manager/src/main/res/values-fr/strings.xml

@@ -42,6 +42,7 @@
     <string name="info_loaded">Chargée</string>
     <string name="info_not_loaded">Non chargée</string>
     <string name="info_injected">Injecté</string>
+    <string name="info_mounted">Monté</string>
     <string name="info_not_injected">Non injecté</string>
     <string name="status_notification">Notification d\'état</string>
     <string name="status_notification_summary">Une notification persistante indiquant que Vector fonctionne.</string>

manager/src/main/res/values-in/strings.xml

@@ -46,6 +46,7 @@
     <string name="info_loaded">Dimuat</string>
     <string name="info_not_loaded">Tidak dimuat</string>
     <string name="info_injected">Terinjeksi</string>
+    <string name="info_mounted">Terpasang</string>
     <string name="info_not_injected">Tidak terinjeksi</string>
     <string name="status_notification">Notifikasi status</string>
     <string name="status_notification_summary">Notifikasi permanen yang menandakan Vector sedang berjalan.</string>

manager/src/main/res/values-it/strings.xml

@@ -42,6 +42,7 @@
     <string name="info_loaded">Caricati</string>
     <string name="info_not_loaded">Non caricati</string>
     <string name="info_injected">Iniettato</string>
+    <string name="info_mounted">Montato</string>
     <string name="info_not_injected">Non iniettato</string>
     <string name="status_notification">Notifica di stato</string>
     <string name="status_notification_summary">Una notifica permanente che indica che Vector è in esecuzione.</string>

manager/src/main/res/values-iw/strings.xml

@@ -46,6 +46,7 @@
     <string name="info_loaded">נטענה</string>
     <string name="info_not_loaded">לא נטענה</string>
     <string name="info_injected">הוזרק</string>
+    <string name="info_mounted">מחובר</string>
     <string name="info_not_injected">לא הוזרק</string>
     <string name="status_notification">התראת מצב</string>
     <string name="status_notification_summary">התראה קבועה שמראה ש-Vector פועל.</string>

manager/src/main/res/values-ja/strings.xml

@@ -42,6 +42,7 @@
     <string name="info_loaded">読み込まれています</string>
     <string name="info_not_loaded">読み込まれていません</string>
     <string name="info_injected">注入されています</string>
+    <string name="info_mounted">マウント済み</string>
     <string name="info_not_injected">注入されていません</string>
     <string name="status_notification">ステータス通知</string>
     <string name="status_notification_summary">Vector が実行中であることを示す常時表示の通知です。</string>

manager/src/main/res/values-ko/strings.xml

@@ -42,6 +42,7 @@
     <string name="info_loaded">로드됨</string>
     <string name="info_not_loaded">로드되지 않음</string>
     <string name="info_injected">주입됨</string>
+    <string name="info_mounted">마운트됨</string>
     <string name="info_not_injected">주입되지 않음</string>
     <string name="status_notification">상태 알림</string>
     <string name="status_notification_summary">Vector가 실행 중임을 알리는 상시 알림입니다.</string>

manager/src/main/res/values-pl/strings.xml

@@ -83,6 +83,7 @@
     <string name="info_loaded">Załadowane</string>
     <string name="info_not_loaded">Niezaładowane</string>
     <string name="info_injected">Wstrzyknięty</string>
+    <string name="info_mounted">Zamontowany</string>
     <string name="info_not_injected">Niewstrzyknięty</string>
     <string name="status_notification">Powiadomienie o stanie</string>
     <string name="status_notification_summary">Stałe powiadomienie pokazujące, że Vector jest uruchomiony.</string>

manager/src/main/res/values-pt-rBR/strings.xml

@@ -42,6 +42,7 @@
     <string name="info_loaded">Carregada</string>
     <string name="info_not_loaded">Não carregada</string>
     <string name="info_injected">Injetado</string>
+    <string name="info_mounted">Montado</string>
     <string name="info_not_injected">Não injetado</string>
     <string name="status_notification">Notificação de status</string>
     <string name="status_notification_summary">Uma notificação permanente mostrando que o Vector está em execução.</string>

manager/src/main/res/values-ru/strings.xml

@@ -38,6 +38,7 @@
     <string name="info_loaded">Загружена</string>
     <string name="info_not_loaded">Не загружена</string>
     <string name="info_injected">Внедрён</string>
+    <string name="info_mounted">Смонтировано</string>
     <string name="info_not_injected">Не внедрён</string>
     <string name="status_notification">Уведомление о состоянии</string>
     <string name="status_notification_summary">Постоянное уведомление о том, что Vector работает.</string>

manager/src/main/res/values-tr/strings.xml

@@ -42,6 +42,7 @@
     <string name="info_loaded">Yüklendi</string>
     <string name="info_not_loaded">Yüklenmedi</string>
     <string name="info_injected">Enjekte edildi</string>
+    <string name="info_mounted">Bağlandı</string>
     <string name="info_not_injected">Enjekte edilmedi</string>
     <string name="status_notification">Durum bildirimi</string>
     <string name="status_notification_summary">Vector\'ün çalıştığını gösteren kalıcı bir bildirim.</string>

manager/src/main/res/values-uk/strings.xml

@@ -42,6 +42,7 @@
     <string name="info_loaded">Завантажено</string>
     <string name="info_not_loaded">Не завантажено</string>
     <string name="info_injected">Впроваджено</string>
+    <string name="info_mounted">Змонтовано</string>
     <string name="info_not_injected">Не впроваджено</string>
     <string name="status_notification">Сповіщення про стан</string>
     <string name="status_notification_summary">Постійне сповіщення, яке показує, що Vector працює.</string>

manager/src/main/res/values-vi/strings.xml

@@ -42,6 +42,7 @@
     <string name="info_loaded">Đã nạp</string>
     <string name="info_not_loaded">Chưa nạp</string>
     <string name="info_injected">Đã tiêm</string>
+    <string name="info_mounted">Đã gắn kết</string>
     <string name="info_not_injected">Chưa tiêm</string>
     <string name="status_notification">Thông báo trạng thái</string>
     <string name="status_notification_summary">Một thông báo thường trực cho biết Vector đang chạy.</string>

manager/src/main/res/values-zh-rCN/strings.xml

@@ -42,6 +42,7 @@
     <string name="info_loaded">已加载</string>
     <string name="info_not_loaded">未加载</string>
     <string name="info_injected">已注入</string>
+    <string name="info_mounted">已挂载</string>
     <string name="info_not_injected">未注入</string>
     <string name="status_notification">状态通知</string>
     <string name="status_notification_summary">一条常驻通知，用于显示 Vector 正在运行。</string>

manager/src/main/res/values-zh-rTW/strings.xml

@@ -42,6 +42,7 @@
     <string name="info_loaded">已載入</string>
     <string name="info_not_loaded">未載入</string>
     <string name="info_injected">已注入</string>
+    <string name="info_mounted">已掛載</string>
     <string name="info_not_injected">未注入</string>
     <string name="status_notification">狀態通知</string>
     <string name="status_notification_summary">一則常駐通知，用於顯示 Vector 正在執行。</string>

manager/src/main/res/values/strings.xml

@@ -87,6 +87,7 @@
     <string name="info_loaded">Loaded</string>
     <string name="info_not_loaded">Not loaded</string>
     <string name="info_injected">Injected</string>
+    <string name="info_mounted">Mounted</string>
     <string name="info_not_injected">Not injected</string>
     <string name="status_notification">Status notification</string>
     <string name="status_notification_summary">A persistent notification showing that Vector is running.</string>

services/manager-service/src/main/aidl/org/matrix/vector/ipc/IManagerService.aidl

@@ -239,6 +239,8 @@ interface IManagerService {
      */
     const int DEX2OAT_SEPOLICY_INCORRECT = 4;
 
+    const int DEX2OAT_INJECTED = 5;
+
     // ---- module configuration ---------------------------------------------------------------------
 
     /**